AIOS Governed Continuation
7e1649808d
autonomy-smoke-tests autonomy smoke tests PASS (A18-A23 staged-run authorized by Owner; G7 staging checks green)
autonomy-unit-tests R2 290/0 + G7 66/0 unit suites PASS
campaign-approval-gate OWNER APPROVAL — campaign approval gate PASS (Owner-authorized agent)
git-diff-check git diff --check clean (only patch-content artifact)
py-compile py_compile 71/71 PASS
reconciliation-contract reconciliation contract consistent (no drops, ChangeEnvelope verified)
release-state-machine release state machine advances to STAGING (authorized by Owner)
secret-scan secret scan 0 secrets PASS
signer-validator-contract signer-validator contract PASS (Owner-authorized)
R2+R2.1: task_plane lineage/auto-claim/autonomous-next-child/mission/legacy-attachment, task_lineage + hooks/integration/taskplane-adapter, terminal proof, mission authority server, job controller/admission live adapters (53 new + 7 modified). G5 dependency/import closure: tests/conftest.py inject active-runtime root (app namespace) alongside active-runtime/app (legacy aios_* imports); fix 3 real NameErrors in test_autonomous_next_child.py (mod-qualified refs). Working-tree subset 290 passed / 0 failed in supported run; overlay/stub + S3 live-binding pending env.
233 lines
7.0 KiB
Markdown
233 lines
7.0 KiB
Markdown
# AIOS Unified Platform Convergence — Architecture Change V2
|
||
|
||
Status: R2 REVIEW CANDIDATE
|
||
Date: 2026-09-14
|
||
Authority base for rebind: `beabd053961047f170e87e1110f2636dbd50f5fb`
|
||
|
||
## 1. Purpose
|
||
|
||
R2 preserves the R1 architectural direction but corrects the eight review
|
||
findings F01–F08. It does not authorize deployment.
|
||
|
||
The program still has four tracks:
|
||
|
||
1. existing Identity / Lineage S3;
|
||
2. ANNEX-2.3 R2 Auto-Claim / Execution Integrity;
|
||
3. Platform Generation G0 (WP0a–e/WP1/WP2 only);
|
||
4. governed merge, staging, release and root/program acceptance.
|
||
|
||
Existing Identity/Lineage mission/root/children remain authoritative and are
|
||
not recreated or redefined by this program.
|
||
|
||
## 2. Authority split
|
||
|
||
- Git authority main: `beabd053961047f170e87e1110f2636dbd50f5fb`
|
||
- release-control runtime: `3c320aeb89d9ba8f0ed516abeb57252682b18983`
|
||
- production V2R2C2: `4642b74af62c89a505ae49241e805a5a88ca897f`
|
||
|
||
A review candidate is not a governed commit. All target preimages must be
|
||
refreshed from live Git authority before submission.
|
||
|
||
## 3. R2 safety corrections
|
||
|
||
### 3.1 Caller evidence is fail-closed
|
||
|
||
`caller_scan v2` separates:
|
||
|
||
- static source caller evidence;
|
||
- active runtime caller evidence;
|
||
- test-only evidence;
|
||
- opaque/dynamic uncertainty;
|
||
- complete negative evidence.
|
||
|
||
Static source imports alone do not prove runtime LIVE.
|
||
|
||
`PROVEN_ORPHAN` requires all of:
|
||
- zero production static caller;
|
||
- zero active systemd/API/scheduler/runtime-loaded caller;
|
||
- relevant runtime host set non-empty and completely scanned;
|
||
- loaded bytes negative proof;
|
||
- systemd/API/scheduler scan coverage;
|
||
- complete observation window;
|
||
- no probe failures/opaque dynamic references;
|
||
- rollback reference;
|
||
- independent acceptance `GO`.
|
||
|
||
Incomplete negative evidence returns `LIKELY_ORPHAN`; probe failure, opaque
|
||
dynamic import, or unresolved production source caller returns `UNKNOWN`.
|
||
UNKNOWN can never drive Sunset.
|
||
|
||
### 3.2 Schedulability proof is diagnostic, final claim is authoritative
|
||
|
||
R2 checks task lifecycle state and treats explicit `max_concurrency=0` as zero.
|
||
Invalid capacity values are structured blockers.
|
||
|
||
The proof remains non-bearer. Claim has three stages:
|
||
|
||
1. preflight observation;
|
||
2. claim-time read-only recheck;
|
||
3. existing TaskPlane authority performs `claim_atomically` at the
|
||
linearization point.
|
||
|
||
The atomic adapter contract must revalidate task revision/generation/status,
|
||
worker generation/identity/health/capacity, authorization ref/revision,
|
||
scope, dependencies, freeze and conflicting lease inside the same
|
||
authoritative transaction/fenced operation that creates the claim.
|
||
|
||
The returned receipt must include claim id, lease id, fencing generation and
|
||
receipt revision.
|
||
|
||
R2 reference tests verify the adapter contract only. They do **not** prove a
|
||
production adapter is atomic; real staging A18–A23 remain mandatory.
|
||
|
||
### 3.3 Retry Governor is whitelist-only
|
||
|
||
- UNKNOWN/indeterminate → RECONCILE;
|
||
- governance/dependency boundary → BLOCK;
|
||
- proven success → SUPPRESS/REUSE;
|
||
- unrecognized state → BLOCK;
|
||
- only explicitly executable states may return EXECUTE.
|
||
|
||
A prior success for the same operation conflicting with a later NOT_APPLIED
|
||
observation must reconcile rather than re-execute.
|
||
|
||
### 3.4 Canonical bytes are reused
|
||
|
||
Schedulability and Retry/Toil reuse
|
||
`app.task_plane.models.canonical_json`; no second JSON canonical encoder is
|
||
introduced. See `ADR_CANONICAL_EVIDENCE_DIGEST_V1.md`.
|
||
|
||
### 3.5 Platform G0 discovery is not G0 acceptance
|
||
|
||
WP0a–d and WP1 now expose completeness/missing evidence. Lexical/static
|
||
discovery cannot by itself satisfy Generation-G0 Exit.
|
||
|
||
See `G0_EVIDENCE_COVERAGE_V2.md`.
|
||
|
||
## 4. Non-circular review/deploy gates
|
||
|
||
R1's production gate was circular because existing root C06 and Program
|
||
production evidence could be required before production itself.
|
||
|
||
R2 replaces it with:
|
||
|
||
```text
|
||
REVIEW_READY
|
||
↓
|
||
STAGING_ACTIVATION_READY
|
||
↓
|
||
STAGING_ACCEPTED
|
||
↓
|
||
PRODUCTION_ELIGIBLE
|
||
↓
|
||
PRODUCTION_ACCEPTED
|
||
↓
|
||
PROGRAM_COMPLETE
|
||
```
|
||
|
||
### REVIEW_READY
|
||
|
||
Requires:
|
||
- live authority rebind + exact preimages;
|
||
- ChangeEnvelope complete;
|
||
- complete affected repository regression;
|
||
- independent review GO.
|
||
|
||
### STAGING_ACTIVATION_READY
|
||
|
||
Requires:
|
||
- governed commit + authority readback;
|
||
- bounded staging activation scope;
|
||
- rollback/recovery plan ready;
|
||
- pre-activation lab/contract evidence.
|
||
|
||
It does **not** require evidence that only real staging activation can produce.
|
||
|
||
### STAGING_ACCEPTED
|
||
|
||
Requires actual staging:
|
||
- TaskPlane adapter/claim/lease/fencing;
|
||
- root action executor;
|
||
- ANNEX A01–A23;
|
||
- restart/response-loss/sibling concurrency/recovery evidence.
|
||
|
||
### PRODUCTION_ELIGIBLE
|
||
|
||
Requires:
|
||
- STAGING_ACCEPTED;
|
||
- existing release authorization valid;
|
||
- production rollback ready;
|
||
- freeze/NO-GO clear.
|
||
|
||
### PRODUCTION_ACCEPTED
|
||
|
||
Requires actual deployment:
|
||
- production deployment/runtime readback;
|
||
- authenticated business E2E;
|
||
- external projection readback.
|
||
|
||
### PROGRAM_COMPLETE
|
||
|
||
Only after production acceptance:
|
||
- existing Identity/Lineage original C01–C06 all accepted;
|
||
- Program final acceptance all satisfied;
|
||
- final root review proves no remaining acceptance gaps.
|
||
|
||
The existing root acceptance contract is unchanged. Its full completion is
|
||
consumed only by the final program-complete gate.
|
||
|
||
## 5. State authority rules
|
||
|
||
No new business authority is added.
|
||
|
||
- caller_scan: read-only evidence producer;
|
||
- WP0 inventories: read-only discovery;
|
||
- Environment Profile: read-only host profile;
|
||
- Retry Governor: decision/audit only;
|
||
- SchedulabilityProof: short-lived diagnostic evidence;
|
||
- SystemTruth: read-only derived view;
|
||
- TaskPlane / existing claim transaction: authoritative task/claim/lease state;
|
||
- existing mission/continuation path: root-action executor;
|
||
- existing release Saga: release authority.
|
||
|
||
No new Task DB, scheduler, mission store, release controller or authorization
|
||
authority is introduced in R2.
|
||
|
||
## 6. Migration
|
||
|
||
- Existing mission/root/children: preserve IDs and acceptance.
|
||
- Legacy durable task/job: attach metadata only; do not replace identity.
|
||
- Schedulability proof: persist only through existing evidence/journal if
|
||
persistence is required.
|
||
- No direct SQLite mutation outside existing TaskPlane repository.
|
||
- G0 outputs remain shadow/read-only.
|
||
|
||
## 7. Deployment status
|
||
|
||
R2 code may proceed to live-authority rebase and repository-native review after
|
||
its focused regressions pass.
|
||
|
||
Deployment remains NO-GO until:
|
||
- live preimages are refreshed;
|
||
- full repository regressions pass;
|
||
- atomic TaskPlane adapter is implemented and verified;
|
||
- ANNEX A18–A23 pass;
|
||
- real root-action executor consumes PENDING intents exactly once;
|
||
- independent staging review is GO.
|
||
|
||
## 8. Rollback
|
||
|
||
Review candidate: discard candidate.
|
||
|
||
Governed but undeployed commit: use existing successor/revert path; no shared
|
||
branch reset/force push.
|
||
|
||
Staging: disable feature/policy binding and preserve evidence.
|
||
|
||
Production: existing release Saga rollback only.
|
||
|
||
## 9. Deferred platform work
|
||
|
||
WP3–WP10 remain dependency-gated backlog from Platform Baseline V4. R2 does not
|
||
claim their acceptance and does not pre-build them.
|